Read the docs

draftpress

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

draftpress records in CISA KEV

No draftpress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Header Footer Code Manager 4 records MEDIUM My Site Audit 1 record LOW

Records

6 records

TI-2021-07073 CVE-2021-24791 · GHSA-2j37-h336-4w29

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

Priority MEDIUM 40

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, lead…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05208 Published 2021-11-08 Fixed in 1.1.14 CWE-89
TI-2022-00624 CVE-2022-0710 · GHSA-x9vf-vfg5-v2m7

Header Footer Code Manager <= 1.1.16 Reflected XSS

Priority LOW 32

The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02416 Published 2022-02-24 No fix listed CWE-79
TI-2022-00803 CVE-2022-0899 · GHSA-578w-8w42-q6vh

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

Priority LOW 30

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01284 Published 2022-07-25 Fixed in 1.1.24 CWE-79
TI-2024-03076 CVE-2024-3280 · GHSA-p7qx-x6gw-cw9m

Cross-site scripting in draftpress Follow Us Badges

Priority LOW 28

The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitizatio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00324 Published 2024-05-02 No fix listed CWE-79
TI-2021-06735 CVE-2021-24445 · GHSA-9x8r-8v3j-4x8m

My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 26

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html cap…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00656 Published 2021-08-16 No fix listed CWE-79
Open these records in search →